programming Security & Privacy — 243 tools curated by the community. Most popular: MCP Snitch, OpenRobots, ChatPanel. Each tool comes with a review, tags and alternatives to help you choose.
❓ Frequently asked questions about Security & Privacy
What is Security & Privacy?
Security & Privacy groups 243 tools curated by the mySelectas community. Most popular: MCP Snitch.
What are the best free Security & Privacy tools?
mySelectas lists several free options in this category. See in particular: MCP Snitch, OpenRobots, ChatPanel.
The short version: as MCP adoption grows, this is one of the few tools that actually watches what your AI agent's tool calls are doing instead of trusting the protocol blindly — worth installing if you use Claude Desktop or Cursor with third-party MCP servers, and free if the GPL license works for you.
There isn't yet a crowded field of MCP-specific security monitors — most of what's out there today is generic API-gateway or logging middleware repurposed for MCP, which doesn't understand the protocol's structure or auto-discover your Claude/Cursor configs. MCP Snitch's edge is being purpose-b…
👥 Target audience
Développeurs et équipes utilisant Claude Desktop ou Cursor avec des serveurs MCP tiers, soucieux de la sécurité des appels d'outils IA
🌍 Target countries
Global
🗣️ Available languages
ENGLISH
🔄 Alternatives
Passerelles API génériquesOutils d'observabilité génériques
The short version: a genuinely useful, honest little utility — it does one specific job (generate AI-crawler rules) well, and it's refreshingly upfront that robots.txt can't stop bots that don't want to be stopped.
Compared to writing robots.txt by hand or using generic robots.txt generators that don't track the fast-moving list of AI-specific bots, OpenRobots' edge is staying current on which crawlers are which (training bots vs. search vs. assistants) and bundling the emerging llms.txt standard in the same flow. Its built-in disclaimer is the right call: for bots that actively ignore robots…
👥 Target audience
Site owners and developers managing AI crawler access
The short version: ChatPanel's core promise — use any AI model you want, from a side panel, without your sensitive data leaving your machine unprotected — is a genuinely differentiated pitch against built-in browser AI assistants that lock you into one vendor's model and data policy.
Compared to a browser's native AI sidebar (Chrome's, Edge's Copilot, etc.), ChatPanel trades a slicker single-vendor integration for real model independence and a privacy layer that travels with you even into agents you already use like Claude Code or Codex. The anonymize-then-restore approach for PII is a clever…
👥 Target audience
Privacy-conscious users wanting model-agnostic AI access from their browser
The short version: PolicyStack is a refreshing, developer-native take on cookie consent that fits naturally into a modern app's build and test pipeline, and its open-source Apache-2.0 core with a no-relicensing promise removes the usual fear of getting locked into a SaaS vendor — the main caveat is that its hosted Cloud tier is still in early access with no public pricing yet.
Compared to legacy consent-banner vendors (OneTrust, Cookiebot, and similar), which are typically configured through a web dashboard disconnected from your codebase, PolicyStack's headless, framework-adapter approach me…
👥 Target audience
Developers wanting privacy/consent management integrated into their codebase
The short version: NetBird is a genuinely modern alternative to clunky corporate VPNs, and being open-source with a real free tier makes it low-risk to try — but adopting it means rethinking network access around identity rather than a single VPN password, which is a mindset shift for smaller teams.
Its closest comparison is Tailscale, which pioneered this WireGuard-mesh-plus-SSO model; NetBird's pitch is being open-source end to end (including the AGPLv3 management plane) and self-hostable, whereas Tailscale's control plane is closed-source SaaS. For teams that want to own their infrastructu…
👥 Target audience
IT/DevOps teams replacing corporate VPNs with Zero Trust access
The short version: Friendly Captcha is a genuinely better user experience than Google's reCAPTCHA, and a real, GDPR-friendly alternative if privacy compliance is a business requirement, not just a preference.
reCAPTCHA is free and has near-universal name recognition, but it tracks users across sites for Google's own purposes and has a well-documented history of showing endless puzzle challenges to VPN or privacy-tool users — friction Friendly Captcha's invisible proof-of-work approach avoids entirely. hCaptcha sits in between, also privacy-focused but with its own tracking-for-payment model o…
The short version: Oconee Runtime is enterprise security tooling for a problem that barely existed two years ago — AI coding agents leaking secrets or running unreviewed destructive commands — and it's priced like enterprise security tooling, not a developer utility.
There's no named direct competitor yet in the facts gathered, which fits: dedicated "AI agent governance" as a standalone enterprise product category is still forming, with most current solutions being ad-hoc internal scripts or generic DLP (data loss prevention) tools not built for agent-specific behaviors like prompt content or…
👥 Target audience
Organisations d'ingénierie, équipes sécurité/conformité adoptant des agents de code IA
The short version: Keydris does one specific thing — gate agent actions behind an explicit policy check — and does it at a price point ($0-$99/mo) that individual developers and small teams can actually afford, unlike the enterprise-tier competitors emerging in this space.
It sits in the same new category as Oconee Runtime and similar AI-agent governance tools, but scoped and priced differently: Keydris is per-action authorization (can this specific action happen right now) rather than a full enterprise monitoring/SIEM platform, and it's accessible at $20/month rather than requiring a $750+/m…
👥 Target audience
Équipes MCP/API et sécurité déployant des agents IA
The short version: TLS Sentry is a zero-dependency way to get a real diagnosis — not just a red X — when a certificate check fails, which is exactly what you want in a 3am cron alert.
Bigger monitoring platforms like UptimeRobot or Pingdom bundle certificate expiry checks alongside general uptime monitoring, but they're SaaS products with their own accounts and pricing tiers; TLS Sentry is a free, self-hosted CLI you drop into an existing cron job or CI pipeline with no dependencies to manage. It's the right pick if you already have monitoring infrastructure and just want sharper cert diagnos…
👥 Target audience
Équipes DevOps/SRE et administrateurs système voulant un moniteur d'expiration de certificat sans dépendance pour cron/CI
The short version: SHIM is a compliance-and-privacy checkpoint for LLM API traffic that you can drop in front of OpenAI, Anthropic and Gemini calls without touching your application code.
Most teams handle PII redaction with custom middleware written ad hoc per project; SHIM packages that as a reusable gateway covering three major providers at once, plus rate limiting and cost tracking most homegrown solutions skip. The free Community Edition is genuinely useful for a single-instance deployment, but its process-local state means it won't share rate-limit or audit state across multiple replica…
👥 Target audience
Équipes construisant des applications LLM soumises à des exigences de conformité (RGPD, AI Act) et de protection des données
🌍 Target countries
International
🗣️ Available languages
EN
🔄 Alternatives
middleware de rédaction PII maisonproxys LLM génériques
The short version: lockenv is the fastest path from "our .env is a liability" to "our secrets are encrypted in Git" — one command, no cloud account required.
SOPS and git-crypt solve the same core problem but both demand more setup (key management conventions, GPG or KMS integration) before they're useful, and HashiCorp Vault is a full server you'd run and maintain just to hold secrets a small team could manage in a file. lockenv trades some of Vault's centralized access control for radical simplicity: one binary, one command, works fully offline. It's free, so the only real cost is that key …
👥 Target audience
Développeurs et petites équipes voulant committer des secrets chiffrés dans Git sans gestionnaire cloud
The short version: SkillFortify is a solid idea — supply-chain scanning for the AI-agent-skill ecosystem, a category that barely exists yet — but it's young enough (Elastic License 2.0, no public star count, a single maintainer visible) that you're trusting a new, narrowly-tested threat model rather than a mature security product.
Compared to general dependency-scanning tools (Snyk, Dependabot), it's the only one purpose-built for AI *skills* specifically rather than npm/pip packages, which matters since a skill often bypasses normal package-manager scrutiny entirely. Compared to just manuall…
👥 Target audience
Développeurs et équipes sécurité utilisant des agents IA (Claude Code, MCP, LangChain, CrewAI, AutoGen) avec des skills/plugins tiers
The short version: BullSniff targets a real and growing problem — AI-generated storefronts — with a sensible, multi-signal approach (domain history, business records, review patterns) rather than a single naive check, and being free with no account required removes any friction to just trying it before a purchase.
There isn't a direct competitor doing exactly this; the closest comparisons are generic site-safety scanners like Google Safe Browsing or Norton Safe Web, which check for malware and phishing but don't specifically evaluate whether a legitimate-looking store's reviews and business c…
👥 Target audience
Consommateurs en ligne voulant vérifier l'authenticité d'une boutique avant d'acheter
The short version: BugBounty Arsenal packs an unusually wide feature set — web, mobile, and Web3 scanning, plus CI/CD gating — into a free, self-hosted tool built and maintained by a small, active solo/small-team project, and that combination of ambition and small-team maintenance is the main thing to weigh before adopting it.
Against OWASP ZAP or Burp Suite Community, it covers noticeably more ground out of the box (mobile static analysis, smart-contract scanning, AI-written fix guidance) without a license fee, and its "Confirmed" findings model — only flagging issues with direct proof like …
👥 Target audience
Chasseurs de bug bounty, chercheurs en sécurité, équipes de sécurité, pentesters, ingénieurs DevSecOps
The short version: VibeSafe is a sanity check for non-security people shipping AI-generated code fast, not a replacement for a real audit — and for that narrower job, it does something genuinely useful that generic scanners don't: it explains findings in plain English instead of assuming you already know what SQLi means.
Against established players like Snyk or GitGuardian, VibeSafe trades depth for accessibility: it won't catch sophisticated or novel vulnerability classes the way a mature enterprise scanner will, but it's built specifically for the 'vibe coder' who wouldn't run Snyk in the f…
👥 Target audience
Fondateurs non-techniques, indie hackers, builders utilisant Lovable/Bolt/Cursor/Replit, petites équipes qui livrent vite, étudiants et débutants en code
The short version: if you want a fast, self-hosted WAF for a personal or non-commercial project and you're comfortable running MVP-stage security software, Shibuya covers the standard attack patterns with honest documentation about what it can't do yet.
Against established options like ModSecurity or a managed service like Cloudflare WAF, Shibuya's real edge is raw performance (sub-2ms p99 latency in Rust) and full self-hosted control — but the licensing already rules it out for commercial use without a separate arrangement, and at one star it has effectively zero field-tested track record. W…
👥 Target audience
Développeurs et équipes DevOps/sécurité voulant un WAF auto-hébergé pour projets personnels ou non-commerciaux
The short version: if you're a security researcher, pentester or bug-bounty hunter who wants to study real, disclosed exploitation techniques in one organized place, Exploitarium is a free, actively-maintained reference with real community traction behind it.
Against Exploit-DB, the long-standing default in this space, Exploitarium's edge is organization and readability — proof-of-concept folders with accompanying writeups rather than a flat searchable dump — plus it's structured as an open GitHub project that accepts contributions rather than a static submission pipeline. It's not a tool you…
👥 Target audience
Chercheurs en sécurité, pentesters, chasseurs de bug bounty, professionnels cybersécurité
The short version: this is a narrow, single-purpose compliance product for US healthcare providers who need to hit a specific federal accessibility deadline without hiring an hourly consultant — the flat fee is genuinely cheaper and more predictable than ad-hoc consulting, but you're trusting a niche, unproven vendor with a compliance-critical deliverable.
There's no like-for-like competitor named on the site, and realistically the alternative is either a general accessibility consulting firm (typically billed hourly, with unpredictable total cost) or doing the WCAG 2.1 AA audit in-house usin…
👥 Target audience
Petits cabinets médicaux/dentaires et centres de santé communautaires américains recevant Medicare/Medicaid
🌍 Target countries
United States
🗣️ Available languages
EN
🔄 Alternatives
Cabinet de conseil accessibilité facturé à l'heureAudit interne avec outils gratuits (axe, WAVE)Cabinet juridique spécialisé conformité santé
The short version: if you let AI coding agents run commands on your machine and have ever had that small moment of dread right before approving a broad permission grant, ActraDeck gives you a concrete, inspectable checkpoint instead of blind trust — the tradeoff is it's a very young project (0 stars, no visible track record yet) that adds a layer you have to configure and maintain.
There isn't a well-established direct competitor doing exactly this for Claude Code and Codex specifically; most people currently rely on the agent platforms' own built-in permission prompts, which are coarser-grai…
👥 Target audience
Développeurs utilisant des agents de code IA (Claude Code, Codex) sur des systèmes sensibles ou sous contrainte de conformité
🌍 Target countries
Worldwide
🗣️ Available languages
EN
🔄 Alternatives
Prompts de permission natifs de Claude Code/Codex (plus grossiers)Revue manuelle systématique des actions de l'agentSandboxing/conteneurisation de l'agent
The short version: ForgeGuardian packs a genuinely comprehensive scan stack — eight engines, nine ecosystems, 223+ signatures — into a free, local-first tool, but with only 25 GitHub stars it's early enough that you're trusting a young project with a security-critical job.
Snyk and Trivy are the natural comparisons: Trivy is the closest in spirit (free, open-source, broad ecosystem coverage) but ForgeGuardian goes further by combining it with AI-based detection, behavioral analysis, and malware scanning in one local pipeline, rather than relying on a single vulnerability database lookup. Snyk…
👥 Target audience
Ingénieurs DevOps, équipes sécurité et développeurs gérant des dépendances logicielles
